CVE-2016-7478: PHP

High severity, CVSS 7.5. EPSS: 42.4% chance of exploitation in the next 30 days.

Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.

Affected products

• PHP PHP: version 5.0.0 only; version 5.0.1 only; version 5.0.2 only; version 5.0.3 only; version 5.0.4 only; version 5.0.5 only; …

Published 2017-01-11. Last modified 2026-06-17.